ndp481-devpack-enu.exe
Sources: observed in the EchoTrail lab on Windows 11.
Summary
Microsoft .NET Framework 4.8.1 Developer Pack (Microsoft .NET Framework 4.8.1 Developer Pack, Microsoft Corporation)
ndp481-devpack-enu.exe is not in the 2025 snapshot. It was observed in EchoTrail's behavior lab on Windows 11 24H2 on 2026-09-24 installed from winget package Microsoft.DotNet.Framework.DeveloperPack_4.
Get this in your tools
The same record for ndp481-devpack-enu.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/ndp481-devpack-enu.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\lab\in
- C:\Windows\Temp\{61D82062-640A-4BD5-A6C5-970B05D6EC31}\.cr
- C:\Windows\Temp\{11CF0B30-93BF-4717-B402-FC372DB80A7E}\.be
Top Hashes (SHA256)
- 64aa252aefdc8d38b3a29202009c2459802ff6288e1f860f91a16bd445cc7c80
- fd9ae4b63cbc8f7637249c4b29d25281b1f70fbe6d650109dcbf2bdf596cf994
Process Ancestry
Top Grandparents
Top Parents
Lab record
- Installed from
- winget Microsoft.DotNet.Framework.DeveloperPack_4 4.8.1
- Publisher
- Microsoft Corporation
- Persistence
- none
- Network
- none
- Command lines
- 2 patterns (3 launches)
- DLL loads
- 93 patterns (186 loads)
- Registry writes
- 59 patterns (71 writes)
- File writes
- 17 patterns (116 writes)
- HTTP requests
- 0 patterns (0 requests)
- TLS connections
- 0 patterns (0 handshakes)
- Named pipes
- 5 patterns (5 events)
- Process access
- 0 patterns (0 events)
- Driver loads
- 0 patterns (0 loads)
- PowerShell blocks
- 0 patterns (0 blocks)
- Remote threads
- 0 patterns (0 events)
- Audit events
- 2 patterns (3 events)
Full record on Team.
Ask Rocky about ndp481-devpack-enu.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for ndp481-devpack-enu.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.